# YPMS — TODO Checklist

**Owner:** DOES CIO
**Last touched:** 2026-09-30
**Scope:** everything from team formation through Go-Live and steady-state operations. Companion tracker: [`POAM.md`](POAM.md) holds the numbered, dated, milestone-tracked version of the ATO items below.

Legend: `[ ]` open · `[~]` in progress · `[x]` done · `[!]` blocked · `[?]` needs decision

---

## 0. Team formation and governance

- [x] ISSO assigned in writing for YPMS (Chris Tonjes; `YPMS-POAM-090` closed 2026-09-30)
- [x] AO designated in writing (Chris Tonjes; `YPMS-POAM-002` closed 2026-09-30; role-concentration acceptance in SSP §5)
- [ ] Business Owner named (OYP)
- [ ] DOES OIT delivery lead named
- [ ] Backend engineer(s) assigned
- [ ] Frontend engineer(s) assigned
- [ ] Data/integration engineer assigned (owns OSSE, CFSA, SSA, DC MAR, payroll)
- [ ] Test/QA lead assigned
- [ ] DC OCTO cloud coordination POC identified

## 1. Stack and architecture decisions

- [x] **Stack decision** — Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment; recorded 2026-09-30)
- [x] Azure Government confirmed as hosting (aligned with OWC and Employer 360)
- [?] **Level 3 security clarification** — source RFP `C.5.7.24` (`YPMS-POAM-051`)
- [?] **Youth identity model** — social-media login scope, IAL2-equivalent proofing before payroll actions, parental co-auth for under-18 (`YPMS-POAM-050`)
- [?] **PCI DSS applicability** — expected out of scope since payroll is ACH via vendor (`YPMS-POAM-052`)
- [?] **Health-record CSV path disposition** — in-boundary vs. emergency extension (`YPMS-POAM-053`)
- [?] **Retention policy** — audit logs, case records, backups (`YPMS-POAM-054`)
- [ ] SORN applicability determination (`YPMS-POAM-094`)
- [ ] Correct the youth-age typo from the source RFP (glossary says "99–24"; should be 14–24) in derived requirements
- [x] High-level architecture document v0.1 drafted (`ypms/ARCHITECTURE.md`, 2026-09-30)
- [x] Conceptual data model in `ARCHITECTURE.md` §6 (25 core entities enumerated); logical + physical ERDs remain
- [ ] Logical and physical ERDs, full data dictionary, CRUD matrix (extends `ARCHITECTURE.md` §6)
- [ ] Security architecture review with DC OCTO (referenced in `ARCHITECTURE.md` §8)

## 2. Environments and pipeline

- [ ] Azure Government subscription requested and provisioned (`YPMS-POAM-041`)
- [ ] Dev environment
- [ ] Test environment
- [ ] Production environment (later)
- [ ] CIS Azure Foundations baseline applied to all environments
- [ ] Azure Key Vault (FIPS 140-3 HSM) provisioned (`YPMS-POAM-032`)
- [ ] Managed Identity model for service-to-service auth
- [ ] Postgres flexible server provisioned (private endpoint)
- [ ] Git repo initialized under `ypms/` (this directory) with branch protection
- [ ] CI/CD pipeline scaffold (`YPMS-POAM-042`)
  - [ ] Build + unit-test gate
  - [ ] SAST gate
  - [ ] SCA (dependency vulnerability) gate
  - [ ] Secret scanning gate
  - [ ] SBOM generation per release (CycloneDX)
  - [ ] Container image scanning
- [ ] Sentinel integration for log streaming (`YPMS-POAM-043`)
- [ ] Backup + restore procedure documented and tested (`YPMS-POAM-044`)

## 3. Data-sharing agreements & interconnections

Existing DOES agreements cover the current OYP workflows; YPMS-scope amendments or renewals are the path, not new drafts.

- [ ] **DOES–OSSE data-sharing agreement (FERPA)** — renewal / YPMS-scope amendment (`YPMS-POAM-020`) — **blocks OSSE ingest build**
- [ ] **DOES–CFSA MOU (DC Code Title 4)** — renewal / YPMS-scope amendment (`YPMS-POAM-021`) — **blocks CFSA ingest build**
- [ ] **SSA Electronic Information Exchange agreement** — renewal / YPMS-scope confirmation (`YPMS-POAM-022`) — **blocks SSN cross-match build**
- [ ] **DC MAR service agreement** — confirm coverage under existing OCTO umbrella
- [ ] **Payroll vendor selection + security review + ISA/DPA** (`YPMS-POAM-023`) — **blocks payroll integration build**
- [ ] **LMS vendor selection + security review** — blocks orientation-tracking build
- [ ] **DC OCTO Sentinel MOU / ingestion agreement**
- [ ] **NOC coordination arrangement** — 30-day maintenance-window notice cadence
- [ ] **Emergency health-record CSV path** — either MOU with source or scoping decision to defer (`YPMS-POAM-053`)
- [ ] ISAs / NIST 800-47 Rev. 1 documents for each of the above (`YPMS-POAM-084`)

## 4. ATO artifacts

- [x] Draft SSP v0.3 (`ypms/SYSTEM_SECURITY_PLAN.md`) — in-house build reframe complete (`YPMS-POAM-010`)
- [x] Draft NIST 800-53 control mapping v0.2 (`ypms/NIST_800_53_CONTROL_MAPPING.md`) — in-house build reframe complete (`YPMS-POAM-015`)
- [x] Draft POA&M v0.1 (`ypms/POAM.md`) — reflects in-house build model
- [ ] **FIPS 199 categorization memo** signed by AO (`YPMS-POAM-001`)
- [x] **Privacy Impact Assessment v0.1 drafted** (`YPMS-POAM-011`; `ypms/PRIVACY_IMPACT_ASSESSMENT.md`; 2026-09-30) — awaiting Privacy Officer + OGC review, then AO signature
- [ ] **Incident Response Plan** — tabletop with DC OCTO SOC (`YPMS-POAM-012`)
- [ ] **Contingency Plan** — functional restore drill (`YPMS-POAM-013`)
- [ ] **Rules of Behavior** — staff / host / youth+parent variants with parental-consent flow (`YPMS-POAM-014`)
- [ ] **Continuous Monitoring Strategy** document (`YPMS-POAM-074`)
- [ ] **Independent Control Assessment (SCA)** commissioned and executed (`YPMS-POAM-060`)
- [ ] **Penetration test** commissioned and executed (`YPMS-POAM-061`)
- [ ] **ATO decision package** compiled and submitted to AO
- [ ] **ATO signed** before production data flows in

## 5. Build

Iterative Agile delivery (Scrum/Kanban/SAFe — match OWC's phased approach). Illustrative phase breakdown; refine at architecture kickoff.

- [ ] **Phase 1 — Foundation.** Auth, user model, RBAC, base UI shell, admin skeleton, audit-logging framework.
- [ ] **Phase 2 — Application intake.** Youth registration, application form, save/resume, document upload with malware scanning.
- [ ] **Phase 3 — Eligibility engine.** Rules-driven auto-eligibility from Appendix D of source RFP; categorical eligibility across programs.
- [ ] **Phase 4 — External integrations.** DC MAR address verification, SSA SSN verify (blocked on `YPMS-POAM-022`), OSSE ingest (blocked on `YPMS-POAM-020`), CFSA ingest (blocked on `YPMS-POAM-021`).
- [ ] **Phase 5 — Certification and orientation.** Certification event workflow, LMS integration.
- [ ] **Phase 6 — Host/employer.** Host registration, worksite management, job posting.
- [ ] **Phase 7 — Matching and enrollment.** Job matching engine, program enrollment.
- [ ] **Phase 8 — Time and payroll.** Online timekeeping, payroll vendor integration (blocked on `YPMS-POAM-023`), transportation vouchers, tax forms.
- [ ] **Phase 9 — Reporting.** Native reports replacing MicroStrategy; audit-log search.
- [ ] **Phase 10 — Admin functions.** Broadcast notifications, workflow rule maintenance, user profile management.

## 6. Security implementation (crosscuts all phases)

- [ ] MFA for staff and admin (Entra ID conditional access) (`YPMS-POAM-030`)
- [ ] TLS 1.2+ enforced everywhere; SSL Labs A+ on public endpoints (`YPMS-POAM-031`)
- [ ] FIPS 140-3 cryptography (`YPMS-POAM-032`)
- [ ] IAL2-equivalent identity proofing before payroll actions (`YPMS-POAM-033`)
- [ ] SSN masking + at-rest encryption (`YPMS-POAM-080`)
- [ ] System-use notification banner (`YPMS-POAM-070`)
- [ ] Auto-disable inactive accounts (`YPMS-POAM-071`)
- [ ] Quarterly privileged-access recert process (`YPMS-POAM-072`)
- [ ] Annual all-user access recert process (`YPMS-POAM-073`)
- [ ] Language Access Act compliance (`YPMS-POAM-081`)
- [ ] Section 508 / WCAG 2.1 AA compliance audit (`YPMS-POAM-082`)
- [ ] Parental consent workflow for under-18 (`YPMS-POAM-083`)
- [ ] Anti-bot / rate-limit for MBSYEP peak windows (`YPMS-POAM-101`)

## 7. Testing

- [ ] Unit-test coverage target set and enforced in CI
- [ ] Functional tests per feature
- [ ] Non-functional tests: performance (99.5% SLA envelope, <1s response), load (50%/year growth headroom)
- [ ] Accessibility tests (Section 508)
- [ ] Language-access tests
- [ ] UAT plan and test scripts approved
- [ ] Vulnerability scanning cadence in production (`YPMS-POAM-062`)

## 8. Legacy retirement & data migration

- [ ] Data-migration plan from each of the seven legacy tools (`YPMS-POAM-105`)
- [ ] Data-quality baselines documented per source
- [ ] PII handling during migration
- [ ] Cutover strategy — big-bang vs. phased-by-program
- [ ] Read-only archive of legacy data for audit / statute-of-limitations retention
- [ ] Legacy system decommission schedule and destruction evidence (`YPMS-POAM-106`)

## 9. Training & change management

- [ ] Training plan for OYP staff, host/employer, youth self-service (`YPMS-POAM-091`)
- [ ] System overview intro video (MP4, closed captioned)
- [ ] Role-based training materials
- [ ] Help / KB content with an updateable help system

## 10. Go-Live & steady-state

- [ ] Go/No-Go decision meeting with AO
- [ ] Cutover runbook rehearsed
- [ ] Go-Live
- [ ] Post-Go-Live retrospective

## 11. Continuous monitoring (steady-state cadence)

- [ ] Monthly vulnerability scans
- [ ] Monthly POA&M review by DOES ISSO
- [ ] Quarterly privileged access recertification
- [ ] Annual full access recertification
- [ ] Annual Contingency Plan test (tabletop + functional element)
- [ ] Annual Independent Control Assessment
- [ ] Annual penetration test
- [ ] Annual SSP refresh
- [ ] Monthly availability performance report against 99.5% SLA

---

## Immediate next actions (this week)

1. ~~SSP v0.3 in in-house build framing~~ ✓
2. ~~Control mapping v0.2 in in-house build framing~~ ✓
3. ~~POA&M v0.1 seeded~~ ✓
4. ~~ISSO / AO / System Owner: Chris Tonjes (with role-concentration risk acceptance)~~ ✓
5. ~~Stack: Python 3.12 / FastAPI / SQLAlchemy / Postgres (OWC alignment)~~ ✓
6. ~~Draft the PIA — minors + FERPA + CFSA is the substantive part~~ ✓ (v0.1 drafted 2026-09-30)
7. Get **existing OSSE, CFSA, and SSA agreements pulled from OGC files** to scope renewals (`YPMS-POAM-020`, `YPMS-POAM-021`, `YPMS-POAM-022`)
8. Draft the **FIPS 199 categorization memo** for AO signature (`YPMS-POAM-001`)
9. ~~Start the architecture document~~ ✓ (`ypms/ARCHITECTURE.md` v0.1 drafted 2026-09-30)
10. Route PIA v0.1 to Privacy Officer + OGC review
11. ~~Author PHASE0_PLAN.md~~ ✓ (`ypms/PHASE0_PLAN.md` v0.1 drafted 2026-09-30)
12. DC OCTO security architecture review meeting scheduled

## Parking lot (not yet triaged)

- Emerging-tech (GenAI/ML) posture — ethical measures required; data must stay in DOES domain (`YPMS-POAM-103`)
- FOIA response workflow with PII redaction (`YPMS-POAM-102`)
- Records schedule alignment with DOES records officer
- Approved-software list governance (`YPMS-POAM-100`)
- Employer 360 dependency: once E360 lands, YPMS host/employer records should consume it rather than re-implementing employer matching